harnery 0.25.0 → 0.26.0

package/dist/commands/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6IhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAuJhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/commands/harness.js

@@ -1,3 +1,4 @@
+import { workflowSubscriptionOnly } from "../core/config.js";
 import { createBuiltinHarnessRegistry, listAttestations, runHarnessAttestation, runHarnessBench, } from "../core/harnesses/index.js";
 const registry = createBuiltinHarnessRegistry();
 export function registerHarnessCommand(program, emit) {
@@ -66,6 +67,7 @@ export function registerHarnessCommand(program, emit) {
         .command("attest [harnesses...]")
         .description("Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.")
         .option("--yes", "Confirm that this spends real vendor tokens")
+        .option("--subscription-only", "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)")
         .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
         .option("--json", "Machine-readable attestation report")
         .action(async (harnesses, opts) => {
@@ -87,7 +89,12 @@ export function registerHarnessCommand(program, emit) {
             return;
         }
         try {
-            const report = await runHarnessAttestation(registry, { harnesses, timeoutMs });
+            const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly();
+            const report = await runHarnessAttestation(registry, {
+                harnesses,
+                timeoutMs,
+                subscriptionOnly,
+            });
             if (opts.json) {
                 emit.config({ format: "json" });
                 emit.data(report);
@@ -121,9 +128,10 @@ export function registerHarnessCommand(program, emit) {
                 emit.text("No attestations recorded. Run `harness attest --yes` to create one.");
                 return;
             }
-            emit.text(renderTable(["HARNESS", "VERSION", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
+            emit.text(renderTable(["HARNESS", "VERSION", "BILLING", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
                 record.harness,
                 record.binary_version,
+                record.subscription_only ? "subscription" : "any",
                 record.observed_at,
                 Object.entries(record.observations)
                     .map(([dimension, support]) => `${dimension}=${support}`)

package/dist/core/harnesses/attest.d.ts

@@ -36,6 +36,11 @@ export interface RunHarnessAttestationOptions {
     timeoutMs?: number;
     cwd?: string;
     coordRoot?: string;
+    /** Scrub API-key vars from the child so it can only use its stored login,
+     * matching `workflow run --subscription-only`. The observation is recorded
+     * against this mode, because a child that may fall back to an API key can
+     * behave differently from one that may not. */
+    subscriptionOnly?: boolean;
     /** Test seam and alternate host probe. A null version means unavailable. */
     versionProbe?: (binary: string) => string | null;
     /** Test seam. Defaults to the adapter's production spawner. */

package/dist/core/harnesses/attest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAetD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAyFnC"}
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAqBtD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA4FnC"}

package/dist/core/harnesses/attest.js

@@ -5,7 +5,7 @@
  * uses, so what gets attested is the path production takes rather than a
  * parallel test rig.
  */
-import { profileDigest, sealAttestation, writeAttestation } from "./attestation.js";
+import { ATTESTATION_SCHEMA_VERSION, profileDigest, sealAttestation, writeAttestation, } from "./attestation.js";
 import { probeBinaryVersion } from "./bench.js";
 /** Fixed and content-free, so nothing user-supplied can reach the record and
  * the turn stays as cheap as a turn can be. */
@@ -15,18 +15,26 @@ export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
  * included. Reports are bounded evidence, so the reason is collapsed to one
  * short line and the echoed prompt is removed. */
 const MAX_NOTE_REASON_CHARS = 200;
+/** Keep the TAIL, not the head. A CLI prints its banner, config, and startup
+ * warnings first and the reason it actually failed last, so truncating from the
+ * front reliably preserves the noise and discards the answer. Learned the hard
+ * way: a head-truncated note once surfaced a cosmetic startup warning while
+ * hiding the real "out of credits" failure on the final line. */
 function boundedReason(reason) {
     if (!reason)
         return "no error reported";
     const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+    if (!collapsed)
+        return "no error reported";
     return collapsed.length > MAX_NOTE_REASON_CHARS
-        ? `${collapsed.slice(0, MAX_NOTE_REASON_CHARS)}…`
+        ? `…${collapsed.slice(-MAX_NOTE_REASON_CHARS)}`
         : collapsed;
 }
 export async function runHarnessAttestation(registry, opts = {}) {
     const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
     const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
     const cwd = opts.cwd ?? process.cwd();
+    const subscriptionOnly = opts.subscriptionOnly === true;
     const versionProbe = opts.versionProbe ?? probeBinaryVersion;
     const now = opts.now ?? (() => new Date());
     const results = [];
@@ -50,6 +58,7 @@ export async function runHarnessAttestation(registry, opts = {}) {
                     timeoutMs,
                     maxTurns: 1,
                     cwd,
+                    subscriptionOnly,
                 });
         }
         catch (error) {
@@ -80,10 +89,11 @@ export async function runHarnessAttestation(registry, opts = {}) {
             cost: result.costUsd !== undefined ? "supported" : "unsupported",
         };
         const record = sealAttestation({
-            schema_version: 1,
+            schema_version: ATTESTATION_SCHEMA_VERSION,
             harness: id,
             binary_version: binaryVersion,
             profile_digest: profileDigest(adapter.profile),
+            subscription_only: subscriptionOnly,
             observed_at: now().toISOString(),
             observations,
         });

package/dist/core/harnesses/attestation.d.ts

@@ -12,7 +12,7 @@
  * published.
  */
 import type { CapabilitySupport, HarnessId, HarnessProfile } from "./types.js";
-export declare const ATTESTATION_SCHEMA_VERSION = 1;
+export declare const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
@@ -27,6 +27,10 @@ export interface HarnessAttestation {
     /** Digest of the capability declaration at record time, so an edited
      * declaration also invalidates the record. */
     profile_digest: string;
+    /** The billing policy the probe ran under. A child launched with API keys
+     * scrubbed can behave differently from one that can fall back to them, so an
+     * observation only speaks for the mode it was made in. */
+    subscription_only: boolean;
     observed_at: string;
     /** Only what the probe actually saw. A dimension absent from this map was
      * not observed, which is not the same as unsupported. */
@@ -54,7 +58,7 @@ export declare function readAttestation(harness: HarnessId, opts?: AttestationSt
 export declare function validateAttestation(value: unknown, harness?: HarnessId): HarnessAttestation | null;
 /** An attestation speaks only for the vendor version and declaration it was
  * recorded against. */
-export declare function isAttestationCurrent(record: HarnessAttestation | null, binaryVersion: string | null, profile: HarnessProfile): record is HarnessAttestation;
+export declare function isAttestationCurrent(record: HarnessAttestation | null, binaryVersion: string | null, profile: HarnessProfile, subscriptionOnly?: boolean): record is HarnessAttestation;
 export declare function listAttestations(opts?: AttestationStoreOptions): HarnessAttestation[];
 /** Both harness-derived proof inputs, read once, for a workflow run
  * (ADR 0038). Callers inject the result so the engine performs no capability
@@ -62,6 +66,9 @@ export declare function listAttestations(opts?: AttestationStoreOptions): Harnes
  * citation; that absence is not a proof unknown. */
 export declare function harnessProofInputs(profiles: readonly HarnessProfile[], opts: AttestationStoreOptions & {
     versionProbe: (binary: string) => string | null;
+    /** Billing policy this run will use, so a record made under the other mode
+     * is not cited as if it applied. */
+    subscriptionOnly?: boolean;
 }): {
     harnessEvidence: Record<string, {
         toolEvidence: HarnessProfile["capabilities"]["toolEvidence"];

package/dist/core/harnesses/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,6DAA8D,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,GACtB,MAAM,IAAI,kBAAkB,CAI9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACjD,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CA2BA"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,6DAA8D,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,IAAI,kBAAkB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD;wCACoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CAoCA"}

package/dist/core/harnesses/attestation.js

@@ -15,7 +15,7 @@ import { mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFile
 import { resolve } from "node:path";
 import { monorepoRoot } from "../agents/coord-client.js";
 import { stableDigest } from "../workflow/durable-record.js";
-export const ATTESTATION_SCHEMA_VERSION = 1;
+export const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
@@ -114,11 +114,13 @@ export function validateAttestation(value, harness) {
 }
 /** An attestation speaks only for the vendor version and declaration it was
  * recorded against. */
-export function isAttestationCurrent(record, binaryVersion, profile) {
+export function isAttestationCurrent(record, binaryVersion, profile, subscriptionOnly) {
     if (!record || !binaryVersion)
         return false;
     if (record.binary_version !== binaryVersion)
         return false;
+    if (subscriptionOnly !== undefined && record.subscription_only !== subscriptionOnly)
+        return false;
     return record.profile_digest === profileDigest(profile);
 }
 export function listAttestations(opts = {}) {
@@ -156,8 +158,9 @@ export function harnessProofInputs(profiles, opts) {
             // No coord root or unreadable store: run unattested rather than fail.
             continue;
         }
-        if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile))
+        if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile, opts.subscriptionOnly)) {
             continue;
+        }
         harnessAttestations[profile.id] = {
             binary_version: record.binary_version,
             observed_at: record.observed_at,

package/dist/core/harnesses/bench.d.ts

@@ -42,6 +42,9 @@ export interface HarnessBenchOptions {
     coordRoot?: string;
     /** Test seam. Defaults to reading the attestation store. */
     attestationReader?: (harness: HarnessId) => HarnessAttestation | null;
+    /** Only cite attestations recorded under this billing mode. Omitted means
+     * any mode is acceptable for reporting purposes. */
+    subscriptionOnly?: boolean;
 }
 export declare function runHarnessBench(registry: HarnessRegistry, opts?: HarnessBenchOptions): HarnessBenchReport;
 /** Ask an installed vendor CLI what version it is. Null when it is absent or

package/dist/core/harnesses/bench.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;CACvE;AAgDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2KD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}
+{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;IACtE;wDACoD;IACpD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2KD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}

package/dist/core/harnesses/bench.js

@@ -30,7 +30,9 @@ function loadAttestation(id, version, adapter, opts) {
         // No coord root, unreadable store: the bench still runs, just unattested.
         return null;
     }
-    return isAttestationCurrent(record, version, adapter.profile) ? record : null;
+    return isAttestationCurrent(record, version, adapter.profile, opts.subscriptionOnly)
+        ? record
+        : null;
 }
 /** First version-shaped token in a string, or null when there is none.
  * Tolerates the vendor prefixes and suffixes real CLIs print, so

package/dist/core/harnesses/profiles.d.ts

@@ -14,8 +14,8 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "claude";
         readonly effortValues: readonly ["low", "medium", "high", "xhigh", "max"];
         readonly verified: {
-            readonly date: "2026-07-20";
-            readonly version: "current CLI contract";
+            readonly date: "2026-07-25";
+            readonly version: "2.1.197 (Claude Code)";
         };
         readonly capabilities: HarnessCapabilities;
     };
@@ -31,8 +31,8 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "gpt";
         readonly effortValues: readonly ["none", "minimal", "low", "medium", "high", "xhigh"];
         readonly verified: {
-            readonly date: "2026-07-21";
-            readonly version: "codex-cli 0.145.0-alpha.18";
+            readonly date: "2026-07-25";
+            readonly version: "codex-cli 0.144.5";
         };
         readonly capabilities: HarnessCapabilities;
     };
@@ -48,8 +48,8 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "multi";
         readonly effortValues: readonly [];
         readonly verified: {
-            readonly date: "2026-07-21";
-            readonly version: "2026.07.16-899851b";
+            readonly date: "2026-07-25";
+            readonly version: "2026.07.23-e383d2b";
         };
         readonly capabilities: HarnessCapabilities;
     };

package/dist/core/harnesses/profiles.js

@@ -39,7 +39,7 @@ export const BUILTIN_HARNESS_PROFILES = {
         authModel: "own-auth",
         modelFamily: "claude",
         effortValues: ["low", "medium", "high", "xhigh", "max"],
-        verified: { date: "2026-07-20", version: "current CLI contract" },
+        verified: { date: "2026-07-25", version: "2.1.197 (Claude Code)" },
         capabilities: capabilities({
             effortSelection: supported("Mapped to `--effort <level>`."),
             maxTurns: supported("Mapped to `--max-turns <n>`."),
@@ -61,7 +61,7 @@ export const BUILTIN_HARNESS_PROFILES = {
         authModel: "own-auth",
         modelFamily: "gpt",
         effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
-        verified: { date: "2026-07-21", version: "codex-cli 0.145.0-alpha.18" },
+        verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
         capabilities: capabilities({
             effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
             maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
@@ -83,7 +83,7 @@ export const BUILTIN_HARNESS_PROFILES = {
         authModel: "own-auth",
         modelFamily: "multi",
         effortValues: [],
-        verified: { date: "2026-07-21", version: "2026.07.16-899851b" },
+        verified: { date: "2026-07-25", version: "2026.07.23-e383d2b" },
         capabilities: capabilities({
             effortSelection: unsupported("Cursor embeds effort in some parameterized model ids; Harnery does not rewrite model ids."),
             maxTurns: unsupported("cursor-agent exposes no turn-ceiling flag."),

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAc1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAgDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAc1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAgDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -21,6 +21,7 @@ import { exec } from "../../lib/exec.js";
 import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
+import { vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
     validateHarnessEffort("claude-code", req.effort);
     const argv = [
@@ -52,7 +53,7 @@ export function normalizeClaudeResult(raw) {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `claude exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+            error: `claude exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
         };
     }
     let envelope;

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAgB9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAiBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAgB9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAiBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -22,6 +22,7 @@ import { exec } from "../../lib/exec.js";
 import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
+import { vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
     validateHarnessEffort("codex", req.effort);
     if (!resultFile)
@@ -51,7 +52,7 @@ export function normalizeCodexResult(raw) {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `codex exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+            error: `codex exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
         };
     }
     return {

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAU1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA6BxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAU1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA6BxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -22,6 +22,7 @@ import { exec } from "../../lib/exec.js";
 import { validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
+import { vendorFailureText } from "./spawn-failure.js";
 /** Exported for unit tests (no live binary to test against). */
 export function parseCursorOutput(stdout) {
     try {
@@ -57,7 +58,7 @@ export function normalizeCursorResult(raw) {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `cursor-agent exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+            error: `cursor-agent exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
         };
     }
     const parsed = parseCursorOutput(raw.stdout);

package/dist/core/workflow/spawn-failure.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared failure-text extraction for the harness spawn adapters.
+ *
+ * A vendor CLI prints its banner, resolved config, and startup warnings first,
+ * and the reason it actually failed last. Every adapter used to keep the FIRST
+ * 500 characters of the transcript, which reliably preserved the banner and
+ * discarded the answer: a child that died with "your workspace is out of
+ * credits" reported a cosmetic startup warning instead.
+ *
+ * Two rules follow. Keep the tail. Include both streams, because which one
+ * carries the reason varies by vendor and by failure.
+ */
+/** Bounded failure text from a finished child, tail-preserving. */
+export declare function vendorFailureText(raw: {
+    stdout?: string;
+    stderr?: string;
+}, maxChars?: number): string;
+//# sourceMappingURL=spawn-failure.d.ts.map

package/dist/core/workflow/spawn-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-failure.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,mEAAmE;AACnE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,QAAQ,SAAoB,GAC3B,MAAM,CAQR"}

package/dist/core/workflow/spawn-failure.js

@@ -0,0 +1,24 @@
+/**
+ * Shared failure-text extraction for the harness spawn adapters.
+ *
+ * A vendor CLI prints its banner, resolved config, and startup warnings first,
+ * and the reason it actually failed last. Every adapter used to keep the FIRST
+ * 500 characters of the transcript, which reliably preserved the banner and
+ * discarded the answer: a child that died with "your workspace is out of
+ * credits" reported a cosmetic startup warning instead.
+ *
+ * Two rules follow. Keep the tail. Include both streams, because which one
+ * carries the reason varies by vendor and by failure.
+ */
+const DEFAULT_MAX_CHARS = 500;
+/** Bounded failure text from a finished child, tail-preserving. */
+export function vendorFailureText(raw, maxChars = DEFAULT_MAX_CHARS) {
+    const parts = [raw.stderr, raw.stdout]
+        .map((part) => part?.trim())
+        .filter((part) => !!part);
+    if (parts.length === 0)
+        return "";
+    // Both streams, stderr first, so a reason on the unexpected stream survives.
+    const combined = parts.join("\n");
+    return combined.length > maxChars ? `…${combined.slice(-maxChars)}` : combined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harnery",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Multi-agent coordination for AI coding agents - Claude Code, Cursor, and Codex.",
   "license": "MIT",
   "author": "Ryan Kelly",
@@ -186,7 +186,9 @@
     "smoke": "node scripts/smoke-test.mjs",
     "docs:dev": "bun run --cwd docs dev",
     "docs:build": "bun run --cwd docs build",
-    "brand:showcase": "node scripts/build-brand-showcase.mjs"
+    "brand:showcase": "node scripts/build-brand-showcase.mjs",
+    "verify:contracts": "bun run scripts/sync-verified-contracts.ts",
+    "verify:contracts:check": "bun run scripts/sync-verified-contracts.ts --check"
   },
   "dependencies": {
     "@mozilla/readability": "^0.6.0",

package/src/commands/harness.ts

@@ -1,5 +1,6 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
+import { workflowSubscriptionOnly } from "../core/config.ts";
 import {
   type BenchResult,
   createBuiltinHarnessRegistry,
@@ -22,6 +23,7 @@ interface BenchOpts extends FormatOpts {
 interface AttestOpts extends FormatOpts {
   timeout?: string;
   yes?: boolean;
+  subscriptionOnly?: boolean;
 }
 
 const registry = createBuiltinHarnessRegistry();
@@ -94,6 +96,10 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
       "Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.",
     )
     .option("--yes", "Confirm that this spends real vendor tokens")
+    .option(
+      "--subscription-only",
+      "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)",
+    )
     .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
     .option("--json", "Machine-readable attestation report")
     .action(async (harnesses: string[], opts: AttestOpts) => {
@@ -116,7 +122,12 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
         return;
       }
       try {
-        const report = await runHarnessAttestation(registry, { harnesses, timeoutMs });
+        const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly();
+        const report = await runHarnessAttestation(registry, {
+          harnesses,
+          timeoutMs,
+          subscriptionOnly,
+        });
         if (opts.json) {
           emit.config({ format: "json" });
           emit.data(report);
@@ -151,10 +162,11 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
         }
         emit.text(
           renderTable(
-            ["HARNESS", "VERSION", "OBSERVED AT", "OBSERVATIONS"],
+            ["HARNESS", "VERSION", "BILLING", "OBSERVED AT", "OBSERVATIONS"],
             records.map((record) => [
               record.harness,
               record.binary_version,
+              record.subscription_only ? "subscription" : "any",
               record.observed_at,
               Object.entries(record.observations)
                 .map(([dimension, support]) => `${dimension}=${support}`)

package/src/core/harnesses/attest.ts

@@ -8,7 +8,12 @@
 
 import type { SpawnResult } from "../workflow/types.ts";
 import type { AttestableDimension, HarnessAttestation } from "./attestation.ts";
-import { profileDigest, sealAttestation, writeAttestation } from "./attestation.ts";
+import {
+  ATTESTATION_SCHEMA_VERSION,
+  profileDigest,
+  sealAttestation,
+  writeAttestation,
+} from "./attestation.ts";
 import { probeBinaryVersion } from "./bench.ts";
 import type { HarnessRegistry } from "./registry.ts";
 import type { CapabilitySupport, HarnessId } from "./types.ts";
@@ -24,11 +29,17 @@ export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
  * short line and the echoed prompt is removed. */
 const MAX_NOTE_REASON_CHARS = 200;
 
+/** Keep the TAIL, not the head. A CLI prints its banner, config, and startup
+ * warnings first and the reason it actually failed last, so truncating from the
+ * front reliably preserves the noise and discards the answer. Learned the hard
+ * way: a head-truncated note once surfaced a cosmetic startup warning while
+ * hiding the real "out of credits" failure on the final line. */
 function boundedReason(reason: string | undefined): string {
   if (!reason) return "no error reported";
   const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+  if (!collapsed) return "no error reported";
   return collapsed.length > MAX_NOTE_REASON_CHARS
-    ? `${collapsed.slice(0, MAX_NOTE_REASON_CHARS)}…`
+    ? `…${collapsed.slice(-MAX_NOTE_REASON_CHARS)}`
     : collapsed;
 }
 
@@ -58,6 +69,11 @@ export interface RunHarnessAttestationOptions {
   timeoutMs?: number;
   cwd?: string;
   coordRoot?: string;
+  /** Scrub API-key vars from the child so it can only use its stored login,
+   * matching `workflow run --subscription-only`. The observation is recorded
+   * against this mode, because a child that may fall back to an API key can
+   * behave differently from one that may not. */
+  subscriptionOnly?: boolean;
   /** Test seam and alternate host probe. A null version means unavailable. */
   versionProbe?: (binary: string) => string | null;
   /** Test seam. Defaults to the adapter's production spawner. */
@@ -74,6 +90,7 @@ export async function runHarnessAttestation(
   const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
   const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
   const cwd = opts.cwd ?? process.cwd();
+  const subscriptionOnly = opts.subscriptionOnly === true;
   const versionProbe = opts.versionProbe ?? probeBinaryVersion;
   const now = opts.now ?? (() => new Date());
   const results: HarnessAttestationResult[] = [];
@@ -99,6 +116,7 @@ export async function runHarnessAttestation(
             timeoutMs,
             maxTurns: 1,
             cwd,
+            subscriptionOnly,
           });
     } catch (error) {
       results.push({
@@ -131,10 +149,11 @@ export async function runHarnessAttestation(
     };
 
     const record = sealAttestation({
-      schema_version: 1,
+      schema_version: ATTESTATION_SCHEMA_VERSION,
       harness: id,
       binary_version: binaryVersion,
       profile_digest: profileDigest(adapter.profile),
+      subscription_only: subscriptionOnly,
       observed_at: now().toISOString(),
       observations,
     });

package/src/core/harnesses/attestation.ts

@@ -25,7 +25,7 @@ import { monorepoRoot } from "../agents/coord-client.ts";
 import { stableDigest } from "../workflow/durable-record.ts";
 import type { CapabilitySupport, HarnessId, HarnessProfile } from "./types.ts";
 
-export const ATTESTATION_SCHEMA_VERSION = 1;
+export const ATTESTATION_SCHEMA_VERSION = 2;
 
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
@@ -43,6 +43,10 @@ export interface HarnessAttestation {
   /** Digest of the capability declaration at record time, so an edited
    * declaration also invalidates the record. */
   profile_digest: string;
+  /** The billing policy the probe ran under. A child launched with API keys
+   * scrubbed can behave differently from one that can fall back to them, so an
+   * observation only speaks for the mode it was made in. */
+  subscription_only: boolean;
   observed_at: string;
   /** Only what the probe actually saw. A dimension absent from this map was
    * not observed, which is not the same as unsupported. */
@@ -164,9 +168,11 @@ export function isAttestationCurrent(
   record: HarnessAttestation | null,
   binaryVersion: string | null,
   profile: HarnessProfile,
+  subscriptionOnly?: boolean,
 ): record is HarnessAttestation {
   if (!record || !binaryVersion) return false;
   if (record.binary_version !== binaryVersion) return false;
+  if (subscriptionOnly !== undefined && record.subscription_only !== subscriptionOnly) return false;
   return record.profile_digest === profileDigest(profile);
 }
 
@@ -194,6 +200,9 @@ export function harnessProofInputs(
   profiles: readonly HarnessProfile[],
   opts: AttestationStoreOptions & {
     versionProbe: (binary: string) => string | null;
+    /** Billing policy this run will use, so a record made under the other mode
+     * is not cited as if it applied. */
+    subscriptionOnly?: boolean;
   },
 ): {
   harnessEvidence: Record<string, { toolEvidence: HarnessProfile["capabilities"]["toolEvidence"] }>;
@@ -220,7 +229,16 @@ export function harnessProofInputs(
       // No coord root or unreadable store: run unattested rather than fail.
       continue;
     }
-    if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile)) continue;
+    if (
+      !isAttestationCurrent(
+        record,
+        opts.versionProbe(profile.binary),
+        profile,
+        opts.subscriptionOnly,
+      )
+    ) {
+      continue;
+    }
     harnessAttestations[profile.id] = {
       binary_version: record.binary_version,
       observed_at: record.observed_at,

package/src/core/harnesses/bench.ts

@@ -65,6 +65,9 @@ export interface HarnessBenchOptions {
   coordRoot?: string;
   /** Test seam. Defaults to reading the attestation store. */
   attestationReader?: (harness: HarnessId) => HarnessAttestation | null;
+  /** Only cite attestations recorded under this billing mode. Omitted means
+   * any mode is acceptable for reporting purposes. */
+  subscriptionOnly?: boolean;
 }
 
 const EMPTY_SUMMARY: Record<BenchVerdict, number> = {
@@ -101,7 +104,9 @@ function loadAttestation(
     // No coord root, unreadable store: the bench still runs, just unattested.
     return null;
   }
-  return isAttestationCurrent(record, version, adapter.profile) ? record : null;
+  return isAttestationCurrent(record, version, adapter.profile, opts.subscriptionOnly)
+    ? record
+    : null;
 }
 
 /** First version-shaped token in a string, or null when there is none.

package/src/core/harnesses/profiles.ts

@@ -43,7 +43,7 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "claude",
     effortValues: ["low", "medium", "high", "xhigh", "max"],
-    verified: { date: "2026-07-20", version: "current CLI contract" },
+    verified: { date: "2026-07-25", version: "2.1.197 (Claude Code)" },
     capabilities: capabilities({
       effortSelection: supported("Mapped to `--effort <level>`."),
       maxTurns: supported("Mapped to `--max-turns <n>`."),
@@ -69,7 +69,7 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "gpt",
     effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
-    verified: { date: "2026-07-21", version: "codex-cli 0.145.0-alpha.18" },
+    verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
     capabilities: capabilities({
       effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
       maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
@@ -95,7 +95,7 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "multi",
     effortValues: [],
-    verified: { date: "2026-07-21", version: "2026.07.16-899851b" },
+    verified: { date: "2026-07-25", version: "2026.07.23-e383d2b" },
     capabilities: capabilities({
       effortSelection: unsupported(
         "Cursor embeds effort in some parameterized model ids; Harnery does not rewrite model ids.",

package/src/core/workflow/spawn-claude.ts

@@ -23,6 +23,7 @@ import { validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 interface ClaudeEnvelope {
@@ -65,7 +66,7 @@ export function normalizeClaudeResult(raw: HarnessRawResult): SpawnResult {
       ok: false,
       text: "",
       durationMs: raw.durationMs,
-      error: `claude exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+      error: `claude exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
     };
   }
 

package/src/core/workflow/spawn-codex.ts

@@ -24,6 +24,7 @@ import { validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): HarnessInvocation {
@@ -53,7 +54,7 @@ export function normalizeCodexResult(raw: HarnessRawResult): SpawnResult {
       ok: false,
       text: "",
       durationMs: raw.durationMs,
-      error: `codex exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+      error: `codex exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
     };
   }
   return {

package/src/core/workflow/spawn-cursor.ts

@@ -24,6 +24,7 @@ import { validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 interface CursorEnvelope {
@@ -72,7 +73,7 @@ export function normalizeCursorResult(raw: HarnessRawResult): SpawnResult {
       ok: false,
       text: "",
       durationMs: raw.durationMs,
-      error: `cursor-agent exited ${raw.exitCode}: ${(raw.stderr || raw.stdout).slice(0, 500)}`,
+      error: `cursor-agent exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
     };
   }
 

package/src/core/workflow/spawn-failure.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared failure-text extraction for the harness spawn adapters.
+ *
+ * A vendor CLI prints its banner, resolved config, and startup warnings first,
+ * and the reason it actually failed last. Every adapter used to keep the FIRST
+ * 500 characters of the transcript, which reliably preserved the banner and
+ * discarded the answer: a child that died with "your workspace is out of
+ * credits" reported a cosmetic startup warning instead.
+ *
+ * Two rules follow. Keep the tail. Include both streams, because which one
+ * carries the reason varies by vendor and by failure.
+ */
+
+const DEFAULT_MAX_CHARS = 500;
+
+/** Bounded failure text from a finished child, tail-preserving. */
+export function vendorFailureText(
+  raw: { stdout?: string; stderr?: string },
+  maxChars = DEFAULT_MAX_CHARS,
+): string {
+  const parts = [raw.stderr, raw.stdout]
+    .map((part) => part?.trim())
+    .filter((part): part is string => !!part);
+  if (parts.length === 0) return "";
+  // Both streams, stderr first, so a reason on the unexpected stream survives.
+  const combined = parts.join("\n");
+  return combined.length > maxChars ? `…${combined.slice(-maxChars)}` : combined;
+}